Computer systems exist, see FIG. 1, which include a plurality LANs 50 located at diverse geographic locations, such as 10, 20, 30 and 40, interconnected by a WAN 60 such as the internet. The system may also include one or more servers, databases and/or message queues and/or other network components associated with the WAN 60 or one of the LANs 50. A plurality of terminals or end points, such as C11 to C14 at location 10, C21 and C22 at location 20 and C31 at location 30, can be connected to one or more of the LANs 50 or directly to the WAN 60. Each end point can be a PC and may have a plurality of attributes and run a plurality of programs or applications. Each PC often interacts over the WAN 60 or LAN 50 with network components or other PCs. An application often performs more than one activity. For example, the program Outlook can send and receive e-mails, add or remove an appointment from a calendar and other activities. In turn each activity is usually constructed from a plurality of operations such as key strokes and mouse clicks, each of which generates one or more opcodes representing operations.
Computer systems and components thereof have many attributes. Some of the attributes are identifying attributes (eg. identification of logged-in user, LAN subnet where it resides, timestamp of an activity, keyboard and mouse interactions, operating system on a server or PC or the PC or component itself.) Some of the attributes are baselined attributes (eg. latency of an activity of the system.) FIG. 2 shows, in schematic form, PCs at a single location grouped according to certain identifying attributes. For example, all of the PCs in the left box operate off of DNS server DNS-1 while all of the PCs in the right hand box operate off of DNS server DNS-2. The PCs are also identified according to department of the logged in user such as sales or engineering. PCs also have backend identifying attributes such as the Database that particular PC's operation relies on.
Presently monitoring systems exist which monitor network components and applications running thereon either by using scripts to emulate a user or by having an agent associated with the network component that can be queried either periodically or as needed to see if the network component or application is functioning properly. These systems are usually at a shared data center, see FIG. 1. at a location such as 40 and are preprogrammed Of course the shared data center can be at any location, even locations 10, 20 or 30.